PPP · Topic 1 of 3

PPP Profiles

Learn how a RouterOS PPP profile sets addresses, DNS, rate limits, encryption and session rules for PPTP, L2TP and PPPoE users, and how it is applied.

5 min

In a nutshell

Profiles live under /ppp profile and are shared by PPTP, L2TP, PPPoE, SSTP and OpenVPN.
If a secret names no profile, the profile default is used.
local-address is the router end and remote-address is the client end.

What it is

A PPP profile is a named set of connection settings that RouterOS applies to a PPP session.

Every PPP based service uses profiles. That includes PPTP, L2TP, PPPoE, SSTP and OpenVPN. The profile decides what the other end of the link receives, such as its address, DNS server and speed limit.

The profile lives under /ppp profile. A user account in /ppp secret points to a profile by name. If the account names no profile, the profile called default is used.

How it works

The profile gives defaults to the session, and the secret or the service can override some of them.

Where a profile is chosen

A profile is picked in three places:

the profile setting of a /ppp secret entry
the default-profile setting of a server such as the PPTP, L2TP or PPPoE server
the profile setting of a client interface, which controls the client side of its own link

The secret wins over the server default. A profile named in the secret is used even when the server names a different one.

Common profile settings

Setting	What it does
`local-address`	The address given to the router end of the link. It can be an IP address or the name of an IP pool.
`remote-address`	The address given to the client. It can be an IP address or the name of an IP pool.
`dns-server`	DNS server sent to the client.
`rate-limit`	Speed limit for the session, written as receive and transmit values.
`only-one`	Allows one session per user, or several.
`use-encryption`	Controls MPPE encryption: yes, no, default or required.
`session-timeout`	Maximum length of a session.
`idle-timeout`	Drops a session after a period without traffic.
`bridge`	Adds the dynamic interface to a bridge as a port.
`change-tcp-mss`	Adjusts the TCP maximum segment size on the link.
`address-list`	Puts the client address into a firewall address list.
`incoming-filter` and `outgoing-filter`	Name a firewall chain for each direction of the session.

The rate-limit value has the form receive/transmit, for example 1M/5M. The first value is for traffic coming from the client into the router, and the second is for traffic sent to the client.

RouterOS ships two profiles, default and default-encryption. You can edit them, but a new profile for each service is cleaner.

An example profile

/ip pool add name=vpn-pool ranges=10.10.10.10-10.10.10.50
/ppp profile add name=staff local-address=10.10.10.1 remote-address=vpn-pool dns-server=10.10.10.1 rate-limit=2M/10M only-one=yes use-encryption=yes
/ppp secret add name=anna password=S3cret service=pptp profile=staff

Here the router uses 10.10.10.1 on the link, and each client takes the next free address from the pool. Anna is limited to two megabits of upload and ten megabits of download. A second login with the same name is refused while only-one=yes.

Profile versus secret

The same address settings also exist in /ppp secret. A value in the secret overrides the matching value in the profile. This lets one profile serve many users while one user gets a fixed address.

Checking the result

/ppp active print
/interface print
/ppp profile print

/ppp active print lists the live sessions with the address given to each. Each session also appears as a dynamic interface in /interface print.

Profile on a client

A client interface such as a PPPoE client also takes a profile. There the profile controls the client side of its link, for example whether encryption is required. The address settings usually matter less, because the server decides the addresses.

What to remember for the exam

Seven facts cover most profile questions.

Profiles live under /ppp profile and are shared by PPTP, L2TP, PPPoE, SSTP and OpenVPN.
If a secret names no profile, the profile default is used.
local-address is the router end and remote-address is the client end.
Both address settings accept an IP address or an IP pool name.
A value in /ppp secret overrides the same value in the profile.
rate-limit, only-one and use-encryption control speed, session count and MPPE.
The bridge setting adds the dynamic interface to a bridge.

Exam tip

When a client gets the wrong address, check the secret first, because it overrides the profile.

Common mistakes

These four errors appear again and again.

Swapping the address roles. The local-address belongs to the router and the remote-address belongs to the client. Reversing them gives the client the router address.

Editing the profile and forgetting the secret. A fixed address or profile in the secret hides your profile change, so the client sees no difference.

Reading rate-limit the wrong way round. The first value is traffic from the client to the router. The second is traffic to the client.

Expecting a changed profile to affect live sessions. The new values apply when the client connects again. Remove the active session to test.

Watch out

Setting use-encryption=required rejects clients that cannot do MPPE, so test with a real client before you roll it out.

Check yourself

Work through these three questions.

Which profile is used when a PPP secret does not name one?
The profile called default is used.
What happens when the same address setting is in both the secret and the profile?
The value in /ppp secret overrides the value in the profile.
Which two profile settings give the router end and the client end of the link their addresses?
local-address is the router end, and remote-address is the client end. Each accepts an IP address or an IP pool name.

Topic 1 of 3 in PPP

Test yourself on PPP

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.